When `private: true` and `tenantOverride: true`, the tenant admin should still be able to override it